Sign with DigiCert

Concept

A DigiCert Certificate Authority configured for code signing issues OV (code_signing) and EV (code_signing_ev) certificates from your CertCentral account against a CSR. The signing key must live on an HSM, so Infisical generates the CSR against an HSM key and sends only the CSR to DigiCert. This guide covers using such a CA from the Code Signing product. To set up the CA itself, see DigiCert (CertCentral Services API).

Prerequisites

A DigiCert Certificate Authority created with Purpose set to Code Signing. See DigiCert (CertCentral Services API).
An HSM Connector the signing key can be generated on.

Create a signer

Once a CA is configured for code signing, it appears in the Code Signing → Create Signer wizard’s CA picker. The Signer is created in Pending state while DigiCert processes the order, and flips to Active once the certificate issues. DigiCert’s code-signing workflow includes an out-of-band approval step that the API can’t skip: DigiCert emails an approval link to the order’s approver, and the order stays Pending until someone opens that link and approves it in DigiCert. Depending on your CertCentral account’s settings this can apply per order, so a Signer can sit in Pending even after the organization is validated.

Code-signing certificates require an HSM-backed key. When you select a DigiCert code-signing CA, the Signer wizard locks the key source to HSM and you must pick an HSM Connector.

A Pending signer is checked on a schedule. To poll DigiCert immediately, use Check issuance now from the signer’s actions menu. Hovering the Pending status on the signer’s detail page shows the DigiCert order number so you can open that order in DigiCert to approve it or resend the approval email.

Use an existing order

Each DigiCert order consumes a subscription slot on your CertCentral account. If a code-signing order already exists in this CA’s organization and product, a Signer can use that order instead of placing a new one. This works for orders placed directly in DigiCert too. The Common Name and Validity come from the order. When you pick an order, the Use existing key toggle decides what happens to its certificate:

On: the Signer uses the order’s issued certificate and its existing private key, and nothing is reissued
Off: DigiCert reissues the certificate in the order and revokes the previous certificate

Use existing key

Use this option to bring certificates you already have into Infisical. The certificate stays valid wherever else it’s in use. The certificate and its key need to meet these requirements:

The order’s certificate is issued and hasn’t expired
The certificate’s private key is in the slot of one of your HSM Connectors
The key is RSA-3072, RSA-4096, ECDSA P-256, or ECDSA P-384

If the key doesn’t match the certificate, the request fails and nothing changes.

Infisical UI
API

In the Create Signer wizard’s Certificate step, select the order in Existing order.

In the Signing Key step, select the HSM Connector, turn on Use existing key, and enter the label of the certificate’s private key in Key label. If more than one key in the slot has that label, select the key in Key ID.

To switch an existing signer to the certificate, follow the same steps in Edit Signer.

To create a signer that uses the certificate, call the endpoint that creates a signer with externalConfiguration.importFromExternalOrderId set to the order ID and certificate.hsmKeyLabel set to the key’s label. If more than one private key in the slot has that label, also set certificate.hsmKeyId to the key’s hex-encoded CKA_ID:

{
  "certificate": {
    "keySource": "hsm",
    "hsmConnectorId": "<hsm-connector-id>",
    "hsmKeyLabel": "<key-label>",
    "hsmKeyId": "<optional-hex-key-id>"
  },
  "externalConfiguration": {
    "importFromExternalOrderId": "<order-id>"
  }
}

To switch an existing signer to the certificate, call the endpoint that imports a certificate into a signer with the order ID in externalOrderId and the same certificate fields, without keySource.

To renew the certificate with the same HSM key before it expires, set Renew before.

Reissue the certificate

Infisical UI
API

In the Create Signer wizard’s Certificate step, select the order in Existing order. In the Signing Key step, leave Use existing key off. Leave Existing order empty to place a new order.

Set externalConfiguration.reissueFromExternalOrderId to the order ID on Create Signer or Reissue.

Reissuing into an existing order replaces that order’s certificate. DigiCert revokes the previous certificate within 72 hours, after which it can no longer be used to sign.

Editing a signer

Editing a signer’s Common Name, validity, key source, key algorithm, or CA triggers a fresh issuance. The signer returns to Pending until the new certificate issues, and DigiCert revokes the previous certificate within 72 hours. If you switch the signer to an order’s issued certificate, nothing is issued and the signer uses that certificate right away.

Reissue and renewal

Reissue (changing the key source, key algorithm, or reissuing into an existing order) hits DigiCert’s reissue endpoint, which keeps the same order and its validity and replaces the certificate.
Auto-renewal (when Renew before is set) places a new order linked to the prior one so DigiCert tracks certificate history. If DigiCert reports the prior order as not eligible for renewal, Infisical falls back to a fresh, unlinked order.

Deleting a signer

Deleting a DigiCert code-signing signer revokes its DigiCert order, so the certificate can no longer be used to sign anywhere. Depending on your CertCentral account’s revocation policy, DigiCert may queue the revocation for administrator approval.

Next steps

Once your signer is Active, you can use it to sign artifacts through the Infisical PKCS#11 module. The signing workflow is the same as any other Infisical signer—only the certificate backing it comes from DigiCert.

Sign Windows Executables

Sign .exe, .dll, .msi, and other Windows artifacts with osslsigncode

Sign Java JARs

Sign Java archives with jarsigner

Sign Container Images

Sign OCI container images with Sigstore cosign

Sign with OpenSSL

General-purpose signing with OpenSSL

Get started

Certificate authorities

Managing certificates

Monitoring

Code signing

Sign with DigiCert

Concept

Prerequisites

Create a signer

Use an existing order

Use existing key

Reissue the certificate

Editing a signer

Reissue and renewal

Deleting a signer

Next steps

Sign Windows Executables

Sign Java JARs

Sign Container Images

Sign with OpenSSL

​Concept

​Prerequisites

​Create a signer

​Use an existing order

​Use existing key

​Reissue the certificate

​Editing a signer

​Reissue and renewal

​Deleting a signer

​Next steps

Sign Windows Executables

Sign Java JARs

Sign Container Images

Sign with OpenSSL

Concept

Prerequisites

Create a signer

Use an existing order

Use existing key

Reissue the certificate

Editing a signer

Reissue and renewal

Deleting a signer

Next steps